Command Injection in node-rules

Description

Versions of node-rules prior to 5.0.0 are vulnerable to Command Injection. The package fails to sanitize input rules and passes it directly to an eval call when using the fromJSON function. This may allow attackers to execute arbitrary code in the system if the rules are user-controlled.

Recommendation

Update the node-rules package to the latest compatible version. Followings are version details:

• Affected version(s): < 5.0.0
• Patched version(s): 5.0.0

References

• GHSA-8whr-v3gm-w8h9
• snyk.io
• CWE-78
• OWASP 2021-A3

Related Issues

• Code Injection in node-rules - CVE-2020-7609
• Command Injection in marsdb - Vulnerability
• Command Injection in soletta-dev-app - Vulnerability
• systeminformation SSID Command Injection Vulnerability - CVE-2023-42810

Tags:

npm

node-rules